Critical PHP Security Release on October 21: EasyEngine’s Plan

TL;DR: PHP’s security release for two critical vulnerabilities is scheduled for October 21, 2026, at 14:00 UTC. We’re preparing EasyEngine v4.13.3 to deliver the fixes through the usual ee cli update command. We’ll rebuild and test the patched PHP images, then release the update. When v4.13.3 is available, run it on every server running EasyEngine.

What’s happening

On October 20, the PHP security team gave advance notice of the release. Both vulnerabilities are rated 9.2 under CVSS v4.0. Security researchers are calling them “php2shell”, and they’ve been reported as CVE-2026-109618 and CVE-2026-109619. PHP’s advance notice doesn’t name the CVE IDs.

The full details, including which versions are affected and which versions fix them, come with PHP’s release itself.

Timeline

• October 20, 2026: PHP announces the upcoming security release.
• October 21, 2026, 14:00 UTC (10:00 a.m. EDT / 7:30 p.m. IST): PHP’s scheduled release.
• After the patched official PHP Docker images are published: we’ll rebuild the EasyEngine PHP images and release EasyEngine v4.13.3.

EasyEngine’s release will follow once the patched images are available and our testing is complete. PHP has said it may release earlier if details of either vulnerability become public, or if there’s evidence of active exploitation.

How EasyEngine will deliver the fix

EasyEngine runs each site’s PHP as PHP-FPM in its own Docker container, behind Nginx. That means the fix reaches your sites through EasyEngine’s PHP images: updating the PHP packages of your server’s operating system won’t change the PHP your sites run. Still keep your server’s own packages updated as usual, since the ee command itself runs on the server’s PHP.

Once the official PHP Docker images with the fix are available, we’ll:

1. Rebuild and test the EasyEngine PHP images for PHP 8.2, 8.3, 8.4 and 8.5 on top of them.
2. Release EasyEngine v4.13.3, which moves enabled sites on those PHP versions to the patched images.

You won’t need to build or replace images yourself. Once v4.13.3 is available, ee cli update handles the image updates. Disabled sites will need the patched images before they are brought back online; we’ll include those instructions with the release.

Using EasyEngine Dashboard? No action is needed. The Dashboard will update EasyEngine on your servers automatically once the fix is out.

Sites on PHP 8.1 or older

PHP 8.1 and older are end of life, so the PHP project isn’t expected to fix them. If you have sites on these versions, we strongly recommend moving them to PHP 8.2 or newer.

Extra hardening for sites on Linux

As a precaution, v4.13.3 will also turn off PHP’s session upload progress feature by default for WordPress and PHP sites on Linux, including those on older PHP versions. It will add session.upload_progress.enabled = Off to the site’s PHP configuration unless that file already sets the option. Existing explicit settings will be preserved, so check yours if you’ve configured this feature before.

WordPress core doesn’t use this feature. Ordinary uploads, including the WordPress media uploader, will continue to work. Plugins or custom applications that use PHP’s session-based upload progress tracking may need it enabled.

This is a precaution, not a replacement for patched PHP. PHP’s advance notice does not confirm a workaround for these vulnerabilities. You can apply the setting before the release using the steps below.

What you can do now

Be ready to update. Make sure you can log in with root access to every server running EasyEngine, and run ee cli update soon after v4.13.3 is out. The update needs at least 5 GB of free disk space, so check that now:

# Free disk space
df -h

We recommend running the update inside tmux or screen, so a dropped SSH connection doesn’t interrupt it. Expect a brief interruption for each site while it moves to the patched image.

Check which PHP version each site uses. ee site list shows your sites. For each running WordPress or PHP site, replace example.com below with its domain:

# PHP version of a site
ee shell example.com --command='php -v'

Switch off session upload progress now (optional). You can apply this precaution before v4.13.3 is available. On a Linux server, back up the site’s custom.ini, then open /opt/easyengine/sites/example.com/config/php/php/conf.d/custom.ini. Replace example.com with your domain.

If the file already sets session.upload_progress.enabled, edit that line. Otherwise, add:

session.upload_progress.enabled = Off

Reload PHP for the site:

# Apply the PHP configuration change
ee site reload example.com --php

# Inspect the container's loaded PHP setting
ee shell example.com --command='php -i | grep session.upload_progress.enabled'

The setting should show Off => Off. Repeat for each site you want to change. The release will preserve the setting you’ve added.

To undo your change, restore the previous value or remove the line you added, then reload PHP again. Check upload behavior if your application uses session-based progress tracking. This procedure applies to Linux; EasyEngine’s macOS development setup does not load this custom.ini in the same way.

Plan to move sites on PHP 8.1 or older. One command switches a site to a newer PHP version:

# Move a site to PHP 8.4
ee site update example.com --php=8.4

Take a backup of the site first, and check that your theme and plugins support the newer PHP version. The switch restarts the site, so expect a short interruption. Moving to PHP 8.4 alone does not apply the forthcoming fixes: update to v4.13.3 when it is available.

Where to follow updates

• This post: we’ll update it when v4.13.3 is released.
• PHP: the official announcement and php.net for the release itself.

Thanks to the PHP security team for the advance notice, which gives everyone time to prepare.

Links : PHP announcement | Documentation | GitHub